Skip to content

fix(docs): remove malicious polyfill.io script reference#693

Merged
FBumann merged 1 commit into
mainfrom
fix/remove-malicious-polyfill-io
Jun 1, 2026
Merged

fix(docs): remove malicious polyfill.io script reference#693
FBumann merged 1 commit into
mainfrom
fix/remove-malicious-polyfill-io

Conversation

@FBumann
Copy link
Copy Markdown
Member

@FBumann FBumann commented Jun 1, 2026

Problem

The docs embed https://polyfill.io/v3/polyfill.min.js?features=es6 (an old MkDocs-Material/MathJax recipe). The polyfill.io domain was sold in 2024 and now serves malware as part of a supply-chain attack. Visitors to the docs were shown a suspicious login prompt originating from https://polyfill.io:

The script only existed to backfill ES6 features for legacy browsers (IE11) and is unnecessary today, so it is removed without replacement.

Changes

  • Remove the polyfill.io entry from extra_javascript in mkdocs.yml → fixes all future doc builds

Already done out-of-band

The script tag was baked into 4,530 deployed HTML files across all doc versions (2.0.0–6.1.4) on gh-pages. Those were scrubbed directly and pushed in gh-pages commit a4e2663e — the live site is already clean.

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Chores
    • Removed an external polyfill dependency from the documentation site configuration. This simplifies the site's dependency management while maintaining support for modern browsers.

The polyfill.io domain was sold in 2024 and now serves malware as
part of a supply-chain attack. Visitors to the docs were shown a
suspicious login prompt originating from https://polyfill.io.

The script only existed to backfill ES6 features in legacy browsers
(IE11) and is unnecessary for any modern browser, so it is removed
without replacement.

The already-deployed gh-pages HTML (all versions) was scrubbed
directly in gh-pages commit a4e2663.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented Jun 1, 2026

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 88f1318a-f67d-4c75-ba9f-ed46326b67c7

📥 Commits

Reviewing files that changed from the base of the PR and between 1a0feb7 and e5aa647.

📒 Files selected for processing (1)
  • mkdocs.yml
💤 Files with no reviewable changes (1)
  • mkdocs.yml

📝 Walkthrough

Walkthrough

The polyfill.io ES6 polyfill script is removed from the MkDocs site configuration. MathJax and Plotly script entries remain unchanged in the extra_javascript list.

Changes

Polyfill configuration cleanup

Layer / File(s) Summary
Remove polyfill.io ES6 script
mkdocs.yml
The polyfill.io/v3/polyfill.min.js?features=es6 entry is removed from extra_javascript, leaving MathJax and Plotly script references intact.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 A hop and a skip, away flies the old,
No polyfill needed, the story retold,
Modern browsers stand strong on their own,
Cleaner config, simpler throne! ✨

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately describes the main change: removing the malicious polyfill.io script reference from the documentation configuration.
Description check ✅ Passed The description provides clear context about the security issue and changes, but lacks some template sections like Type of Change checkbox, Related Issues, and Testing sections.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/remove-malicious-polyfill-io

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@FBumann FBumann enabled auto-merge (squash) June 1, 2026 09:37
@FBumann FBumann merged commit a825371 into main Jun 1, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant